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1 Qubits, gates and networks 

Consider the two binary strings, 

Oil, (1) 
111. (2) 

The first one can represent, for example, the number 3 (in binary) and the 
second one the number 7. In general three physical bits can be prepared in 
2^ = 8 different configurations that can represent, for example, the integers 
from to 7. However, a register composed of three classical bits can store only 
one number at a given moment of time. Enter qubits and quantum registers: 

A qubit is a quantum system in which the Boolean states and 1 are rep- 
resented by a prescribed pair of normalised and mutually orthogonal quantum 
states labeled as {|0), |1)} [|l|. The two states form a 'computational basis' and 
any other (pure) state of the qubit can be written as a superposition a|0) + /3|1) 
for some a and /3 such that |ap + |/3p — 1. A qubit is typically a microscopic 
system, such as an atom, a nuclear spin, or a polarised photon. A collection of 
n qubits is called a quantum register of size n. 

We shall assume that information is stored in the registers in binary form. 
For example, the number 6 is represented by a register in state |1) |1) (E) 
|0). In more compact notation: \a) stands for the tensor product |a„_i) <Si 
|a„_2) • ■ ■ |ao), where Ui G {0, 1}, and it represents a quantum register 
prepared with the value a = 2°ao + 2^ai + . . . 2"~-'^a„_i. There are 2" states of 
this kind, representing all binary strings of length n or numbers from to 2" — 1, 
and they form a convenient computational basis. In the following a E {0, 1}" 
(a is a binary string of length n) implies that | a) belongs to the computational 
basis. 

Thus a quantum register of size three can store individual numbers such as 
3 or 7, 

|O)®|1)0|1) = 1011) = |3), (3) 
|1)0|1)®|1) ^ 1111) ^|7), (4) 
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but, it can also store the two of them simultaneously. For if we take the 
first qubit and instead of setting it to |0) or |1) we prepare a superposition 
I/V2 (|0) + |1)) then we obtain 



i=(|0) + |l))®|l)®|l) ^ -i= (1011) + 1111)), 



(5) 
(6) 



In fact we can prepare this register in a superposition of all eight numbers - it 
is enough to put each qubit into the superposition l/-\/2(|0) + |1)) ■ This gives 



i=(|O) + |l))®-i=(|O) + |l))0-i=(|O) + |l)). 



(7) 



which can also be written in binary as (ignoring the normalisation constant 

2-3/2 )^ 

|000) + |001) + |010) + |011) + |100) + |101) + |110) + |111). (8) 
or in decimal notation as 



or simply as 



|0) + |1) + |2) + |3) + |4) + |5) + |6) + |7), 



El-)- 

x=0 



(9) 



(10) 



These preparations, and any other manipulations on qubits, have to be per- 
formed by unitary operations. A quantum logic gate is a device which performs 
a fixed unitary operation on selected qubits in a fixed period of time and a 
quantum network is a device consisting of quantum logic gates whose compu- 
tational steps are synchronised in time ||]. The outputs of some of the gates 
are connected by wires to the inputs of others. The size of the network is the 
number of gates it contains. 

The most common quantum gate is the Hadamard gate, a single qubit gate 
H performing the unitary transformation known as the Hadamard transform. 
It is defined as 



H 



1 
V2 











\x) - 


H 



{-ir\x) + \i-x) 



The matrix is written in the computational basis {| 0) , | 1)} and the diagram on 
the right provides a schematic representation of the gate H acting on a qubit 
in state | x), with x = 0, 1. 

And here is a network, of size three, which affects the Hadamard transform 
on three qubits. If they are initially in state | 000) then the output is the super- 
position of all eight numbers from to 7. 
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|0) 

|o> 

|0) 



H 



H 



H 



|0) + |1) 

|0) + |1) 

|0) + |1) 
V2 



IN BINARY 



1 / |000) + I001) + |010) + |011)+ \ 

-P72j + I 100) + I 101) + I 110) + I 111) / 

_ 1 f |0) + |1) + |2) + |3)+ 1 

- I + I 4) + I 5) + I 6) + I 7) / 



IN DECIMAL 



If the three qubits are initially in some other state from the computational 
basis then the result is a superposition of all numbers from to 7 but exactly 
half of them will appear in the superposition with the minus sign, for example, 



101) 



1 



I 000) - I 001) + |010) - 1 oil) + 
- 1 100) + 1 101) - 1 110) + I 111) 



(11) 



In general, if we start with a register of size n in some state y G {0, 1}" then 

iy)^2-"/2 Yl (-ir^k), (12) 

xe{o,i}" 

where the product of j/ = {Un-i, ■ ■ ■ ,yo) and x = {xn-i, ■ ■ ■ , xq) is taken bit by 
bit: 

y ■x = (un-iXn-i + . . . yixi + yoxo). (13) 

We will need another single qubit gate - the phase shift gate (p defined as 
I 0) I— > I 0) and | 1) i— > e*"^ | 1), or, in matrix notation. 



1 
e*"^ 



\x) 



\x) 



(14) 



The Hadamard gate and the phase; gate can be combined to construct the 
following network (of size four) , which generates the most general pure state of 
a single qubit (up to a global phase), 



|0) 



H 



20 
— 



II 



cos 61 1 0) +6'"^ sin 61 1 1). (15) 



Consequently, the Hadamard and phase gates are sufficient to construct any 
unitary operation on a single qubit. 

Thus the Hadamard gates and the phase gates can be used to transform the 
input state |0)|0)...|0) of the n qubit register into any state of the type |^'i) 
|vl'2)... I^n), where l^ffj) is an arbitrary superposition of |0) and |1). These are 
rather special n-qubit states, called the product states or the separable states. 
In general, a quantum register of size n > 1 can be prepared in states which 
are not separable - they are known as entangled states. For example, for two 
qubits (n = 2), the state 



a|00)+/3|01) = |0)®(a|0)+/3|l)) 



(16) 
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is separable, | *i) = |0) and | *2) = a |0) + P |1), whilst the state 



a |00) +/3 111) 1*2 



(17) 



is entangled (a,/3 0), because it cannot be written as a tensor product. 

In order to entangle two (or more qubits) we have to extend our repertoire 
of quantum gates to two-qubit gates. The most popular two-qubit gate is the 
controUed-NOT (c-not), also known as the XOR or the measurement gate. It 
flips the second (target) qubit if the first (control) qubit is 1 1) and does nothing 
if the control qubit is | 0) . The gate is represented by the unitary matrix 



C = 



( 1 








\ 





1 

















1 


I 





1 


) 



I V) \x®y) 



(18) 



where x,y — or 1 and © denotes XOR or addition modulo 2. If we apply 
the C-NOT to Boolean data in which the target qubit is |0) and the control is 
either |0) or |1) then the effect is to leave the control unchanged while the target 
becomes a copy of the control, i.e. 



\x)\{)) ^ \x)\x) a; = 0,1. 



(19) 



One might suppose that this gate could also be used to copy superpositions such 
as I*) = a |0) +13 |1), so that 



|*)|0) 



(20) 



for any \^). This is not so! The unitarity of the C-not requires that the gate 
turns superpositions in the control qubit into entanglement of the control and 
the target. If the control qubit is in a superposition state l^*) = alO) + /3|1), 
(a,/3 ^ 0), and the target in |0) then the C-not generates the entangled state 



(a|0> +/3|1)) |0) a|00) +/3|11) 



(21) 



Let us notice in passing that it is impossible to construct a universal quan- 
tum cloning machine effecting the transformation in Eq.(pO[), or even the more 
general 

|*)|0)|W) (22) 

whereJW) refers to the state of the rest of the world and \^) is any quantum 
state [|. To see this take any two normalised states |*) and |$) which are non- 
identical (K'&l^')! ^ 1) and non-orthogonal (($|^') ^ ), and run the cloning 
machine. 



l*)|0)|M^) 

m^)\w) 



m^)\w") 



(23) 
(24) 
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As this must be a unitary transformation which preserves the inner product 
hence we must require 

($1*) = (25) 

and this can only be satisfied when |($|\E')| — or 1, which contradicts our 
assumptions. Thus states of qubits, unhke states of classical bits, cannot be 
faithfully cloned. This leads to interesting applications, quantum cryptography 
being one such. 

Another common two-qubit gate is the controlled phase shift gate B{(l)) 
defined as 



/I 














1 














1 





V 











J 



\y) 



e"""^ I X 



\x)\y). (26) 



Again, the matrix is written in the computational basis {| 00) , | 01) , 1 10) , 1 11)} 
and the diagram on the right shows the structure of the gate. 

More generally, these various 2-qubit controlled gates are all of the form 
controlled-f7, for some single-qubit unitary transformation U. The controlled-?/ 
gate applies the identity transformation to the auxiliary (lower) qubit when the 
control qubit is in state | 0) and applies an arbitrary prescribed U when the 
control qubit is in state 1 1). The gate maps | 0) | y) to | 0) | y) and 1 1) | y) to 
1 1) (C/ I y)), and is graphically represented as 



< 


i 




u 









The Hadamard gate, all phase gates, and the C-not, form an infinite uni- 
versal set of gates i.e. if the C-not gate as well as the Hadamard and all phase 
gates are available then any n-qubit unitary operation can be simulated exactly 
with 0(4"n) such gates (Here and in the following we use the asymptotic 
notation - 0{T{n)) means bounded above by cT{n) for some constant c > for 
sufficiently large n.) This is not the only universal set of gates. In fact, almost 
any gate which can entangle two qubits can be used as a universal gate 
Mathematically, an elegant choice is a pair of the Hadamard and the controUed- 
V (c-V) where V is described by the unitary matrix 



V 



1 

i 



(27) 



The two gates form a finite universal set of gates - networks containing only 
a finite number of these gates can approximate any unitary transformation on 
two (and more) qubits. More precisely, if U is any two-qubit gate and e > 
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then there exists a quantum network of size 0(log (l/s)) (where d is a constant) 
consisting of only H and C-V gates which computes a unitary operation U' that 
is within distance e from U The metric is induced by the EucUdean norm 
- we say that U' is within distance e from U if there exists a unit complex 
number A (phase factor) such that \ \U — XU'\ \ < e. Thus if U' is substituted for 
U in a quantum network then the final state a'^ \x) approximates the final 
state of the original network ax \x) as follows: y^J2x I'^^'x " Q^xP < £■ The 
probability of any specified measurement outcome on the final state is affected 
by at most e. 

A quantum computer will be viewed here as a quantum network (or a family 
of quantum networks) and quantum computation is defined as a unitary evolu- 
tion of the network which takes its initial state "input" into some final state 
"output" . We have chosen the network model of computation, rather than Tur- 
ing machines, because it is relatively simple and easy to work with and because 
it is much more relevant when it comes to physical implementation of quantum 
computation. 

2 Quantum arithmetic and function evaluations 

Let us now describe how quantum computers actually compute, how they add 
and multiply numbers, and how they evaluate Boolean functions by means of 
unitary operations. Here and in the following we will often use the modular 
arithmetic . Recall that 

a mod b (28) 

denotes the remainder obtained by dividing integer b into integer a, which is 
always a number less than b. Basically a — b mod n if a = b+kn for some integer 
k. This is expressed by saying that a is congruent to b modulo n or that b is the 
residue of a modulo n. For example, 1 mod 7 = 8 mod 7=15 mod 7 = 50 mod 
7=1. Modular arithmetic is commutative, associative, and distributive. 

(a ± b) mod n = ((a mod n) ± (b mod n)) mod n (29) 
(a X b) mod n = ((a mod n) x (b mod n)) mod n (30) 
(ax (b + c)) mod n — {{{ab) mod n + ((ac) mod n)) mod n (31) 

Thus, if you need to calculate, say, 3* mod 7 do not use the naive approach 
and perform seven multiplications and one huge modular reduction. Instead, 
perform three smaller multiplications and three smaller reductions, 

((3^ mod 7)2 mod 7)^ mod 7 = (2^ mod 7 f mod 7 = 16 mod 7 = 2. (32) 

This kind of arithmetic is ideal for computers as it restricts the range of all inter- 
mediate results. For l-hit modulus n, the intermediate results of any addition, 
subtraction or multiplication will not be more than 21 bits long. In quantum 
registers of size n, addition modulo 2" is one of the most common operations; 
for all X e {0, 1}" and for any a G {0, 1}", 

\x)^\{x + a) mod 2") (33) 



6 



is a well defined unitary transformation. 

The tricky bit in the modular arithmetic is the inverse operation, and here 
we need some basic number theory. An integer a > 2 is said to be prime if 
it is divisible only by 1 and a (we consider only positive divisors). Otherwise, 
a is called composite. The greatest common divisor of two integers a and b is 
the greatest positive integer d denoted d = gcd(a, b) that divides both a and b. 
Two integers a and b are said to be coprime or relatively prime if gcd(a, b) = 1. 
Given two integers a and n that are coprime, it can be shown that there exists 
an unique integer d £ {0, . . . , ti — 1} such that ad = 1 mod n The integer d 
is called inverse modulo n of a, and denoted a^^. For example, modulo 7 we 
find that = 5 mod n, since 3x5 = 15 = 2x7+1 = 1 mod 7. This bizarre 
arithmetic and the notation is due to Karl Friedrich Gauss (1777-1855). It was 
first introduced in his Disquistiones Arithmeticae in 1801. 

In quantum computers addition, multiplication, and any other arithmetic 
operation have to be embedded in unitary evolution. We will stick to the 
Hadamard and the controlled-]/ (c-V), and use them as building blocks for 
all other gates and eventually for quantum adders and multipliers. 

If we apply C-V four times we get identity, so any three subsequent applica- 
tions of C-V give the inverse of C-V, which will be called C-V^ . Now, if we have 
a couple of the C-V gates and a couple of the Hadamard gates we can build the 
C-NOT as follows 







V 




V 






- H 








H - 



A single qubit operation NOT can be performed via a C-NOT gate if the con- 
trol qubit is set to |1) and viewed as an auxiliary qubit. This is not to say 
that we want to do it in practice. The C-not gate is much more difficult to 
build than a single qubit NOT. Right now we are looking into the mathematical 
structure of quantum Boolean networks and do not care about practicalities. 
Our two elementary gates also allow us to construct a very useful gate called 
the controUed-controUed-NOT gate (c^-not) or the Toffoh gate ||l^. The con- 
struction is given by the following network. 



H - V 



V - H 
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This gate has two control qubits (the top two wires on the diagram) and one 
target qubit which is negated only when the two controls are in the state |1)|1)- 
The c^-NOT gate gives us the logical connectives we need for arithmetic. If the 
target is initially set to |0) the gate acts as a reversible and gate - after the gate 
operation the target becomes the logical AND of the two control qubits. 

|a;i,a;2) |0) |xi,a::2) Aa;2) (34) 

Once we have in our repertoire operations such as not, and, and C-not, all of 
them implemented as unitary operations, we can, at least in principle, evaluate 
any Boolean function {0, 1}" {0, 1}™ which map n bits of input into m 
bits of output. A simple concatenation of the Toffoli gate and the C-not gives 
a simplified quantum adder, shown below, which is a good starting point for 
constructing full adders, multipliers and more elaborate networks. 



\y) 







— ^ 





Xl) 



X2) 



X1X2 ® y) 



\Xl} 
\X21 

0) 



) — . 






— ^ 


) — 


) — 



SUM = \xi®X2) 
CARRY 



X1X2 



TOFFOLI GATE 



QUANTUM ADDER 



We can view the Toffoli gate and the evolution given by Eq. (g4|) as a quantum 
implementation of a Boolean function / : {0, 1}^ {0, 1} defined by f{xi,X2) = 
Xl /\ X2- The operation AND is not reversible, so we had to embed it in the 
reversible operation c^-NOT. If the third bit is initially set to 1 rather than 
then the value of xi Ax2 is negated. In general we write the action of the Toffoli 
gate as the function evaluation. 



\xi,X2)\y) \ xi,X2) I {y + {xi A 0:2)) mod 2) , 



(35) 



This is how we compute any Boolean function {0, 1}" {0, 1}™ on a quan- 
tum computer. We require at least two quantum registers; the first one, of size 
n, to store the arguments of / and the second one, of size n, to store the values 
of /. The function evaluation is then a unitary evolution of the two registers. 



\x,y)^\x,{y + f{x))mod 2™). 



(36) 



for any y S {0, 1}™. (In the following, if there is no danger of confusion, we 
may simplify the notation and omit the mod suffix.) 



For example, a network computing / : {0, 1}^ 
acts as follows 



{0, 1}3 such that f{x) ^ . 



|00)|000) ^ |00)|000), 
|01)|000) ^ |01)|001), 

which can be written as 



|10)|000) ^ |10)|100) 
|11)|000) |11>|001) 



(37) 
(38) 



\x, 0) 1-^ \x, x^ mod 



(39) 
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e.g. 32 mod 2^ = 1 which explains why |11)|000) ^ |11)|001). 

In fact, for these kind of operations we also need a third register with the 
so-called working bits which are set to zero at the input and return to zero at 
the output but which can take non-zero values during the computation. 

What makes quantum function evaluation really interesting is its action on 
a superposition of different inputs a;, for example, 

Y,M^Y.\'^,f{x)) (40) 

X X 

produces f{x) for all x in a single run. The snag is that we cannot get them 
all from the entangled state \x, f{x)) because any bit by bit measurement 
on the first register will yield one particular value x' £ {0, 1}" and the second 
register will then be found with the value f{x') £ {0, 1}™. 



3 Algorithms and their complexity 

In order to solve a particular problem, computers, be it classical or quantum, 
follow a precise set of instructions that can be mechanically applied to yield 
the solution to any given instance of the problem. A specification of this set 
of instructions is called an algorithm. Examples of algorithms are the proce- 
dures taught in elementary schools for adding and multiplying whole numbers; 
when these procedures are mechanically applied, they always yield the correct 
result for any pair of whole numbers. Any algorithm can be represented by a 
family of Boolean networks (A^i, N2, Nr^, ...), where the network 7V„ acts on all 
possible input instances of size n bits. Any useful algorithm should have such 
a family specified by an example network Nn and a simple rule explaining how 
to construct the network A'^^^+i from the network 7V„. These are called uniform 
families of networks 

The quantum Hadamard transform defined by Eq. (|l^) has a uniform family 
of networks whose size is growing as n with the number of input qubits. Another 
good example of a uniform family of networks is the quantum Fourier transform 
(QFT) defined in the computational basis as the unitary operation 

|y)^2-"/2^e*i*«-|a:), (41) 

X 

Suppose we want to construct such a unitary evolution of n qubits using our 
repertoire of quantum logic gates. We can start with a single qubit and notice 
that in this case the QFT is reduced to applying a Hadamard gate. Then we 
can take two qubits and notice that the QFT can be implemented with two 
Hadamard gates and the controlled phase shift i3(7r)in between. Progressing 
this way we can construct the three qubit QFT and the four qubit QFT, whose 
network looks like this: 

^This means that the network model is not a self-contained model of computation. We 
need an algorithm, a Turing machine, which maps each n into an explicit description of N„ . 
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\xo) H 



H 



I 0) + e- 



I 0) + e- 





H 



H 



I 0) + e- 



I 0) + e- 




H B{-k) H B{-k/2)B{t:) H B{t: / A)B{-k /2)B{t:) H 



{N.B. there are three different types of the gate in the network above: 



The general case of n qubits requires a trivial extension of the network 
following the same sequence pattern of gates H and B. The QFT network 
operating on n qubits contains n Hadamard gates H and n(n — l)/2 phase 
shifts -B, in total n(n + l)/2 elementary gates. 

The big issue in designing algorithms or their corresponding families of net- 
works is the optimal use of physical resources required to solve a problem. 
Complexity theory is concerned with the inherent cost of computation in terms 
of some designated elementary operations, memory usage, or network size. An 
algorithm is said to be fast or efficient if the number of elementary operations 
taken to execute it increases no faster than a polynomial function of the size 
of the input. We generally take the input size to be the total number of bits 
needed to specify the input (for example, a number N requires log2 N bits of 
binary storage in a computer) . In the language of network complexity - an al- 
gorithm is said to be efficient if it has a uniform and polynomial-size network 
family {0{n'^) for some constant d) [ pT| . For example, the quantum Fourier 
transform can be performed in an efficient way because it has a uniform family 
of networks whose size grows only as a quadratic function of the size of the 
input, i.e. 0(p?). Changing from one set of gates to another, e.g. constructing 
the QFT out of the Hadamard and the controlled- gates with a prescribed 
precision e, can only affect the network size by a multiplicative constant which 
does not affect the quadratic scaling with n. Thus the complexity of the QFT 
is 0(p?) no matter which set of adequate gates we use. Problems which do not 
have efficient algorithms are known as hard problems. 

Elementary arithmetic operations taught at schools, such as long addition, 
multiplication or division of n bit numbers require 0{n^) operations. For ex- 
ample, to multiply x = {xn-i...xiXo) and y = {yn-i...yiyo) we successively 
multiply y by lo, xi and so on, shift, and then add the result. Each multi- 
plication of y by Xk takes about n single bit operations, the addition of the n 
products takes of the order of bit operations, which adds to the total 0{n?) 
operations. Knowing the complexity of elementary arithmetic one can often 
assess the complexity of other algorithms. For example, the greatest common 
divisor of two integers x and y < x can be found using Euclid's algorithm; the 



B{Tr), B{n/2) and S(7r/4).) 
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oldest nontrivial algorithm which has been known and used since 300 BCjj First 
divide x hy y obtaining remainder ri . Then divide y by ri obtaining remainder 
r2, then divide ri by r2 obtaining remainder rs, etc., until the remainder is 
zero. The last non-zero remainder is gcd{x,y) because it divides all previous 
remainders and hence also x and y (it is obvious from the construction that it 
is the greatest common divisor). For example, here is a sequence or remainders 
{rj,rj+i) when we apply EucHd's algorithm to compute gcd(12378, 3054) = 6: 
(12378,3054), (3054,162), (162, 138), (138, 24), (24, 18), (18,6), (6,0). What is 
the complexity of this algorithm? It is easy to see that the largest of the two 
numbers is at least halved every two steps, so every two steps we need one bit 
less to represent the number, and so the number of steps is at most 2n, where 
n is the number of bits in the two integers. Each division can be done with at 
most O(n^) operations hence the total number of operations is O(n^). 

There are basically three different types of Boolean networks: classical deter- 
ministic, classical probabilistic, and quantum. They correspond to, respectively, 
deterministic, randomised, and quantum algorithms. 

Classical deterministic networks are based on logical connectives such as 
AND, OR, and NOT and are required to always deliver correct answers. If a 
problem admits a deterministic uniform network family of polynomial size, we 
say that the problem is in the class P [|l). 

Probabilistic networks have additional "coin flip" gates which do not have 
any inputs and emit one uniformly-distributed random bit when executed dur- 
ing a computation. Despite the fact that probabilistic networks may generate 
erroneous answers they may be more powerful than deterministic ones. A good 
example is primality testing - given an n-bit number x decide whether or not x 
is prime. The smallest known uniform deterministic network family that solves 
this problem is of size 0{n'^^°^^°^"'), which is not polynomially bounded. How- 
ever, there is a probabilistic algorithm, due to Solovay and Strassen |jl^, that 
can solve the same problem with a uniform probabilistic network family of size 
0(n'^ log(l/e)), where e is the probability of error. N.B. e does not depend on 
n and we can choose it as small as we wish and still get an efficient algorithm. 

The log(l/e) part can be explained as follows. Imagine a probabilistic net- 
work that solves a decision problem ^ and that errs with probability smaller 
than i -I- (5 for fixed (5 > 0. If you run r of these networks in parallel (so that the 
size of the overall network is increased by factor r) and then use the majority 
voting for the final YES or NO answer your overall probability of error will 
bounded by e = exp(— i5^r). (This follows directly from the Chernoff bound- see 
for instance, (l^). Hence r is of the order log(l/e). If a problem admits such 
a family of networks then we say the problem is in the class BPP (stands for 
"bounded-error probabilistic polynomial") | pl| . 

Last but not least we have quantum algorithms, or families of quantum 
networks, which are more powerful than their probabilistic counterparts. The 

■^This truly 'classical' algorithm is described in Euclid's Elements, the oldest Greek treatise 
in mathematics to reach us in its entirety. Knuth (1981) provides an extensive discussion of 
various versions of Euclid's algorithm. 

•^A decision problem is a problem that admits only two answrers: YES or NO 
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example here is the factoring problem - given an n-bit number x find a Hst of 
prime factors of x. The smallest known uniform probabilistic network family 
which solves the problem is of size 0(2"""'°^"). One reason why quantum com- 
putation is such a fashionable field today is the discovery, by Peter Shor, of 
a uniform family of quantum networks of 0(n^ loglognlog(l/e)) in size, that 
solve the factoring problem |p^ . If a problem admits a uniform quantum net- 
work family of polynomial size that for any input gives the right answer with 
probability larger than ^ + S foi fixed S > then we say the problem is in the 
class BQP (stands for "bounded-error quantum probabilistic polynomial' ) . 
We have 

P C BPP C BQP (42) 

Quantum networks are potentially more powerful because of multiparticle 
quantum interference, an inherently quantum phenomenon which makes the 
quantum theory radically different from any classical statistical theory. 

Richard Feynman |l^ was the first to anticipate the unusual power of quan- 
tum computers. He observed that it appears to be impossible to simulate a 
general quantum evolution on a classical probabilistic computer in an efficient 
way i.e. any classical simulation of quantum evolution appears to involve an 
exponential slowdown in time as compared to the natural evolution since the 
amount of information required to describe the evolving quantum state in clas- 
sical terms generally grows exponentially in time. However, instead of viewing 
this fact as an obstacle, Feynman regarded it as an opportunity. Let us then fol- 
low his lead and try to construct a computing device using inherently quantum 
mechanical effects. 

4 From interferometers to computers 

A single particle interference in the Mach-Zehnder interferometer works as fol- 
lows. A particle, in this case a photon, impinges on a beam-splitter (BSl), and, 
with some probability amplitudes, propagates via two different paths to another 
beam-splitter (BS2) which directs the particle to one of the two detectors. Along 
each path between the two beam-splitters, is a phase shifter (PS). 
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|0) 



1) 



BSl 



PS 



PS 

'0 



Po = cos^ 



|0) 



If the lower path is labeled as state | 0) and the upper one as state 1 1) 
then the particle, initially in path |0), undergoes the following sequence of 
transformations 



|0) 



;^|(|0) + |1)); 

j±0+ilj_ iiS^ 



V2 



{e'^°\0) + e''^'\l)) 



(43) 



|0)+e^^|l)) 



(cos i (<^o -</-!) I 0) +i sin 1(00 -</-!) I 1)), (44) 

where 0o and <j)i are the settings of the two phase shifters and the action of the 
beam-splitters is defined as 



|0)^^(|0) + |1)), |1)^-^(|0)-|1)). 



(45) 



(We have ignored the phase shift in the reflected beam.) The global phase 

shift e*^^^^ is irrelevant as the interference pattern depends on the difi'erence 
between the phase shifts in different arms of the interferometer. The phase 
shifters in tlic' two paths can be tuned to effect any prescribed relative phase 
shift (p = (po — 4>i and to direct the particle with probabilities 



Po 
Pi 



cos I- 



sm I- 



: -{l + COS(l)) 

i(l-COS(/)) 



(46) 
(47) 



respectively to detectors "0" and "1". 

The roles of the three key ingredients in this experiment are clear. The first 
beam splitter prepares a superposition of possible paths, the phase shifters mod- 
ify quantum phases in different paths and the second beam-splitter combines all 
the paths together erasing all information about which path was actually taken 
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by the particle between the two beam-spUttcrs. This erasure is very important 
as we shall see in a moment. 

Needless to say, single particle interference experiments are not restricted 
to photons. One can go for a different "hardware" and repeat the experiment 
with electrons, neutrons, atoms or even molecules. When it comes to atoms and 
molecules both external and internal degrees of freedom can be used. 

Although single particle interference experiments are worth discussing in 
their own right, here we are only interested in their generic features simply be- 
cause they are all "isomorphic" and once you know and understand one of them 
you, at least for our purposes, understand them all (modulo experimental de- 
tails, of course). Let us now describe any single particle interference experiment 
in more general terms. It is very convenient to view this experiment in a dia- 
gramatic way as a quantum network with three quantum logic gates [p^t . The 
beam-splitters will be now called the Hadamard gates and the phase shifters the 
phase shift gates. In particular any single particle quantum interference can be 
represented by the following simple network. 



H 



H 



In order to make a connection with a quantum function evaluation let us 
now describe an alternative construction which simulates the action of the phase 
shift gate. This construction introduces a phase factor (j> using a controlled-?/ 
gate. The phase shift is "computed" with the help of an auxiliary qubit in a 
prescribed state | u) such that U\u) = e*"^ | u) . 



\0)—H 



H 



Measurement 



U 



In our example, shown above, we obtain the following sequence of transforma- 
tions on the two qubits 



0)\u)>^-^{\0) + \l))\u) 



V2 



c-U 



H 



(cos 1 1 0) 



1)) 



l»l«> 



(48) 



We note that the state of the auxiliary qubit | u) , being an eigenstate of U, is 
not altered along this network, but its eigenvalue e*"^ is "kicked back" in front of 
the 1 1) component in the first qubit. The sequence (|4^) is the exact simulation 
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of the Mach-Zchndcr interferometer and, as we shall see later on, the kernel of 
quantum algorithms. 

Some of the controlled- operations are special - they represent quantum 
function evaluations! Indeed, a unitary evolution which computes / : {0, 1}" i— > 

{0,1}-, 

\x)\y)^\x)\{y + f{x))mod2^), (49) 

is of the controlled-?/ type. The unitary transformation of the second register, 
specified by 

l?y> ^ l(y + ./(.^))niod2'"), (50) 

depends on x - the state of the first register. If the initial state of the second 
register is set to 

by applying the QFT to the state 1 111...1), then the function evaluation gener- 
ates 

1^)1^) = ^\^)T.^^^p[-^y)\y) (52) 
- ^1^) E'«-p(-|?2/)i/(^)+y) (53) 

e^m , ^ (^-^(/(a.) + y)) \f{x) + y) (54) 



= ei*-^(^)|x)|u), (56) 
where we have relabelled the summation index in the sum containing 2™ terms 

E (-l^(/(^) + \fi^) + y) = E ^^p (-fry) \y)- (s^) 

Again, the function evaluation effectively introduces the phase factors in front 
of the I a;) terms in the first register. 

\x)\u)^e^v(^^f{x)^\x)\u) (58) 

Please notice that the resolution in (j){x) ~ ^f{x) is determined by the size 
m of the second register. For m = 1 we obtain (j){x) = Trf(x), i.e. the phase 
factors are (— l)-'^^^^ Let us see how this approach explains the internal working 
of quantum algorithms. 
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5 The first quantum algorithms 



The first quantum algorithms showed advantages of quantum computation with- 
out referring to computational complexity measured by the scaling properties of 
network sizes. The computational power of quantum interference was discovered 
by counting how many times certain Boolean functions have to be evaluated in 
order to find the answer to a given problem. Imagine a "black box" (also called 
an oracle) computing a Boolean function and a scenario in which one wants to 
learn about a given property of the Boolean function but has to pay for each use 
of the "black box" (often referred to as a query). The objective is to minimise 
number of queries. 

Consider, for example, a "black box" computing a Boolean function / : 
{0, 1} 1-^ {0, 1}. There are exactly four such functions: two constant functions 
(/(O) /(I) ^ and /(O) = /(I) = 1) and two "balanced" functions (/(O) = 
0, /(I) = 1 and /(O) = !,/(!) = 0). The task is to deduce, by queries to the 
"black box", whether / is constant or balanced (in other words, whether /(O) 
and /(I) are the same or different). 

Classical intuition tells us that we have to evaluate both /(O) and /(I), which 
involves evaluating / twice (two queries) . We shall see that this is not so in the 
setting of quantum information, where we can solve this problem with a single 
function evaluation (one query), by employing an algorithm that has the same 
mathematical structure as the Mach-Zehnder interferometer. The quantum al- 
gorithm that accomplishes this is best represented as the quantum network 
shown below, where the middle operation is the "black box" representing the 



function evaluation |17 



0) 



H 



H 



Measurement 



|0)-|1) 



|0)-|1) 



The initial state of the qubits in the quantum network is | 0) (| 0) — 1 1)) (apart 
from a normalization factor, which will be omitted in the following). After 
the first Hadamard transform, the state of the two qubits has the form ( | 0) -I- 
I 0) ~ 1 1))- To determine the effect of the function evaluation on this state, 
first recall that, for each a; G {0, 1}, 



(59) 



I=^>(|0)-|1))^ (-l)/(-)|a:)(|0)-|l)). 
Therefore, the state after the function evaluation is 

[(-l)^(°)|0) + (-l)/W|l>](|0)-|l)). (60) 

That is, for each x, the \ x) term acquires a phase factor of (— l)-'^'-^-', which 
corresponds to the eigenvalue of the state of the auxiliary qubit under the action 
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of the operator that sends \ y) to \ y + f{x)). The second qubit is of no interest 
to us any more but the state of the first qubit 



(_l)/(o)|0) + (-l)/(i)|l) 



(61) 



is equal either to 



when /(O) = /(I), or 



±(|0) + |1)) 



±(|0>-|1» 



(62) 



(63) 



when /(O) ^ /(I)- Hence, after applying the second Hadamard gate the state of 
the first qubit becomes | 0) if the function / is constant and 1 1) if the function 
is balanced! A bit-value measurement on this qubit distinguishes these cases 
with certainty. 

This example [0 is an improved version of the first quantum algorithm 
proposed by Deutsch ||l^ (The original Deutsch algorithm provides the correct 
answer with probability 50%.) Deutsch's result laid the foundation for the 
new field of quantum computation, and was followed by several other quantum 
algorithms. 

Deutsch's original problem was subsequently generalised to cover "black 
boxes" computing Boolean functions / : {0,1}" i— > {0,1}. Assume that, for 
one of these functions, it is "promised" that it is either constant or balanced 
{i.e. has an equal number of O's outputs as I's), and the goal is to determine 
which of the two properties the function actually has. How many queries to 
/ are required to do this? Any classical algorithm for this problem would, in 
the worst-case, require 2""^ + 1 queries before determining the answer with 
certainty. There is a quantum algorithm that solves this problem with a single 
evaluation of /. 

The algorithm is illustrated by a simple extension of the network which 
solves Deutsch's problem. 



|0) 



0) 



|0) 





H 




H 


















H 






H 


















H 






H 













Measurement 



Measurement 



Measurement 



|0)-|1)- 



/ 



|o>-|i) 



The control register, now composed out of n qubits (n = 3 in the diagram 
above), is initially in state | 00 • • • 0) and an auxiliary qubit in the second register 
starts and remains in the state | 0) — | 1). 
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Stepping through the execution of the network, the state after the first n- 
qubit Hadamard transform is apphed is 



X 

which, after the function evaluation, is 

Y^{-i)fi^)\x){\Q)~\i)). 



(64) 



(65) 



Finally, after the last Hadamard transform, the state is 

^(_l)/(.)+(-.)|j^)(|0)-|i)). (66) 



Note that the amphtude of | 00 • • • 0) is 



(-1) 



which is (—1)^*^°) when 



/ is constant and when / is balanced. Therefore, by measuring the first n 
qubits, it can be determined with certainty whether / is constant or balanced. 
The algorithm follows the same pattern as Deutsch's algorithm: the Hadamard 
transform, a function evaluation, the Hadamard transform (the H-f-H sequence). 
We recognize it as a generic interference pattern. 



6 Quantum search 

The generic H-f-H sequence may be repeated several times. This can be illus- 
trated, for example, with Grover's data base search algorithm Q. Suppose we 
are given, as an oracle, a Boolean function fk which maps {0, 1}" to {0, 1} such 
that fk{x) — Sxk for some k. Our task is to find k. Thus in a set of numbers 
from to 2" — 1 one element has been "tagged" and by evaluating we have 
to find which one. In order to find k with probability of 50% any classical algo- 
rithm, be it deterministic or randomised, will need to evaluate fk a minimum of 
2'^~^ times. In contrast, a quantum algorithm needs only 0(2"/^) evaluations. 

Unlike the algorithms studied so far, Grover's algorithm consists of repeated 
applications of the same unitary transformation many (0(2"/^)) times. The 
initial state is chosen to be the one that has equal overlap with each of the com- 
putational basis states: | S) — 2~"/^ J2i=o I The operation applied at each 
individual iteration, referred to as the Grover iterate, can be best represented 
by the following network: 



H 



H 



|0) 



/o 
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The components of the network are by now famihar: Hadamard transforms (H) 
and controlled-/ gates. It is important to notice that in drawing the network we 
have used a shorthand notation: the first register (with the | ijj) input) actually 
consists of n qubits. The Hadamard transform is applied to each of those qubits 
and the controlled-/ gates act on all of them simultaneously. Also, the input 
to the second register is always | 0) — 1 1) but the input to the first register, 
denoted | ijj) changes from iteration from iteration, as the calculation proceeds. 
As usual, the second register will be ignored since it remains constant throughout 
the computation. 

To begin, consider only the controlled- //j gate. This is just the phase- 
kickback construction that was introduced in Section 4 but for the specific 
function /fc. In particular, the transformation does nothing to any basis el- 
ements except for | k) , which goes to —\k). Geometrically, this is simply a 
reflection in the hyperplane perpendicular to | k) so let us call it Rk- 

Similarly, with respect to the first register only, the controlled- /o operation 
sends | 0) to — | 0) and fixes all other basis elements, so it can be written Rq. 
Now consider the sequence of operations HRqH. Since H"^ = I, we can rewrite 
the triple as HRqH~^ which is simply Rq performed in a different basis. More 
specifically, it is reflection about the hyperplane perpendicular to 



so we will simply write the triple as Rs- 

We can therefore rewrite the Grover iterate in the simple form G = RsRk- 
Now, since each reflection is an orthogonal transformation with negative de- 
terminant, their composition must be an orthogonal transformation with unit 
determinant, in other words, a rotation. The question, of course, is which rota- 
tion. To find the answer it suffices to consider rotations in the plane spanned by 
I k) and | S) since all other vectors are fixed by the Grover iterate. The generic 
geometrical situation is then illustrated in the following diagram. 



If the vector | a) is reflected through the line Li to produce the vector | a') and 
then reflected a second time through line L2 to produce the vector | a"), then 
the net effect is a rotation by the total subtended angle between | a) and \a"), 
which is2x + 2y = 2{x + y) = 29. 




2' 



1 



(67) 
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Therefore, writing | fc-*-) and | 5-*-) for plane vectors perpendicular to | k) 
and I S) respectively, the Grover iterate performs a rotation of twice the angle 
from \ k-^) to \ S-^) . Setting, sine/) = i^^, this is easily seen to be a rotation by 

2(3^ TT - 20 mod 27r. (68) 

Thus, up to phases, the Grover iterate rotates the state vector by an angle 2(^ 
towards the desired solution | k) . Normally, the initial state for the first register 
is chosen to be \S). Since this initial state | S) is already at an angle to | fc) , 
the iterate should be repeated m times, where 

(2m + l)(/)w|, (69) 

giving 

to get a probability of success bounded below by cos^(20), which goes to 1 as 
n I— > oo. For large n, i^-p^. = sin0 w 0, so 

4 2"/2 ' 

This is an astounding result: any search of an unstructured database can 
be performed in time proportional to the square-root of the number of entries 
in the database. Subsequent work extended the result to searches for multiple 
items |2^, searches of structured databases and many other situations. 
Also, Zalka Boyer et. al and others have demonstrated that Grover's 
algorithm is optimal, in the sense that any other quantum algorithm for search- 
ing an unstructured database must take time at least 0(2"/^). 



7 Optimal phase estimation 

Query models of quantum computation provided a natural setting for subse- 
quent discoveries of "real quantum algorithms" . The most notable example 
is Shor's quantum factoring algorithm [T^ which evolved from the the order- 
finding problem, which was originally formulated in the language of quantum 
queries. Following our "interferometric approach" we will describe this algo- 
rithm in the terms of multiparticle quantum interferometry. We start with a 
simple eigenvalue or phase estimation problem. 

Suppose that IJ is any unitary transformation on m qubits and | u) is an 
eigenvector of U with eigenvalue e*"^ and consider the following scenario. We 
do not explicitly know U or | u) or e"^ , but instead we are given devices that 
perform controlled- [/, controlled-C/^\ controlled-[/^^ and so on until we reach 
controlled-?/^ . Also, assume that we are given a single preparation of the 
state I u) . Our goal is to obtain an n-bit estimator of 0. We start by constructing 
the following network, 
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I 0) + e''2'^ 1 1) 
I 0) + e'2V 1 1) 

I 0) + e^^V 1 1) 



|0) + |1) 
|0) + |1) 

|0) + |1) 



The second register of m qubits is initially prepared in state | u) and remains 
in this state after the computation, whereas the first register of n qubits evolves 
into the state, 

2"-l 

(I 0) + e*2"-V I 0) + e*2"-=0 1 1)) ... (I 0) + \^)) = ^'"^ I v) ■ (72) 

y=o 

Consider the special case where — 27ra;/2" for x = Y11=q 2*2^^, and recall 
the quantum Fourier transform (QFT) introduced in Section 2. The state which 
gives the binary representation of x, namely, | Xn-i ■ ■ ■ xq) (and hence (jj) can be 
obtained by applying the inverse of the QFT , that is by running the network 
for the QFT in the backwards direction (consult the diagram of the QFT). If x 
is an n-bit number this will produce the exact value (j). 

However, does not have to be a fraction of a power of two (and may not 
even be a rational number). For such a 0, it turns out that applying the inverse 
of the QFT produces the best n-bit approximation of with probability at least 
4/7r2 w 0.405. 

To see why this is so, let us write (j) = 27r(a/2" + S), where a = (a„_i . . . ao) 
is the best n-bit estimate of ^ and < < 1/2""''^. Applying the inverse 
QFT to the state in Eq. ( [72| ) now yields the state 

i_'^''^'eW(a-)V-^.|x) (73) 

x=0 y=0 

and the coefhcient in front of | x = a) in the above is the geometric series 

^eV^"^) 

y=o 

Since \5\ < j^ph", it follows that 2"|(5| < 1/2, and using the inequality 2z < 
siuTTz < TTz holding for any z G [0, 1/2], we get |1 - e'^'"-^'^"\ = 2| sin(7r(52")| > 



1 

2" 



1 - (e2'^*'')2" 



(74) 
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4|(5|2". Also, |1 ~ e^'^'-'l = 2| sin7r(5| < 27r5. Therefore, the probabUity of observ- 
ing a„_i • • • ao when measuring the state is 



2" 



1 - (e2^**)2" 

2^ _ g2iri(5 



> 



1 /AS2''- 



2" V 27r(5 



(75) 



which proves our assertion. In fact, the probabihty of obtaining the best esti- 
mate can be made 1 — S for any < (5 < 1, by creating the state in Eq.([72[) 
but with n + 0(log(l/(5)) qubits and rounding the answer off to the nearest n 
bits ilTl. 



8 Periodicity and quantum factoring 

Amazingly, the application of optimal phase estimation to a very particular 
unitary operator will allow us to factor integers efficiently. In fact, it will allow 
us to solve a more general class of problems related to the periodicity of certain 
integer functions. 

Let N be an m-bit integer, and let a be an integer smaller than N, and 
coprime to N. Define a unitary operator Ua acting on m qubits such that for 
ally <N 

\y) ^Ua\y) ^\ay mod N) . (76) 

This unitary operation can be called multiplication by a modulo N. Since a is 
coprime to N, as discussed in Section 2, there exists a least strictly positive r 
such that = 1 mod TV. This r is called the order of a modulo N. Equivalently, 
r is the period of the function f{x) = mod N, i.e. the least r > such that 
f{x) — f{x + r) for all x. We are after the optimal n-bit estimate of this period, 
given some specified precision n. 

Now let the vectors | Uk) {k € {1, . . . , r}) be defined by 

=r-i/2^e-^ |a^' modiV). (77) 

i=o 

It is easy to check that for each fc G {1, . . . , r}, | Uk) is an eigenvector with 
eigenvalue e^'^*" of the modular multiplication operator Ua defined above. 

It is important to observe that one can efficiently construct a quantum net- 
work for controlled multiplication modulo some number N . Moreover, for any j , 
it is possible to efficiently implement a controlled- C/f' gate | 
we can apply the techniques for optimal phase estimation discussed in Section 
7. For any k G {1, . . . , r}, given the state | u^) we can obtain the best n-bit 
approximation to ^ . This is tantamount to determining r itself. Unfortunately, 
there is a complication. 

Our task is: given an m bit long number N and randomly chosen a < N 
coprime with N, find the order of a modulo N. The problem with the above 
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method is that we are aware of no straightforward efficient way to prepare any 
of the states | Uk)- However, the state 



^ ^-1/2 



k=l 

is most definitely an easy state to prepare. 

If we start with 1 1) in place of the eigenvector | m^) , apply the phase estima- 
tion network and measure the first register bit by bit we will obtain n binary 
digits of X such that, with probability exceeding 4/7r^, ^ is the best n-bit es- 
timate of ^ for a randomly chosen k from {1, . . . , r}. The question is: given x 
how to compute r? Let us make few observations: 

• k/r is unique, given x. 

Value a;/2", being the n-bit estimate, differs by at most 1/2"' from k/r. 
Hence, as long as n > 2m, the n bit estimate x determines a unique value 
of ^ since r is an m-bit number. 

• Candidate values for k/r are all convergents to x/2"^. 

For any real number 9, there is a unique sequence of special rationals 
(y^)„gN (gcd(p„, Qn) — 1) called the convergents to that tend to as n 

grows. A theorem H states that if p and q are integers with 



then p/q is a convergent to 9. Since we have ^ < 2{'^")2 — Jr^' ^^^^ 
implies |^ ~ < and fc/r is a convergent to a;/2". 

• Only one convergent is eligible. 

It is easy to show that there is at most one fraction a/b satisfying both 
6<r and |-^-f| < ^. 

Convergents can be found efficiently using the well-known continued fraction 
method . Thus we employ continued fractions and our observations above to 
find a fraction a/b such that 6 < 2™ and |^ — f | < We get the rational 
k/r, and k = a,r ^ b, provided k and r are coprime. For randomly chosen k, 
this happens with probability greater than or equal to 1/ In r |Q . 

Finally, we show how order-finding can be used to factor a composite number 
A^. Let a be a randomly chosen positive integer smaller than N such that 
gcd(a, A) ~ 1. Then the order of a modulo N is defined, and we can find it 
efficiently using the above algorithm. If r is even, then we have: 

a'' = ImodA (79) 
^ (a''/2)2_i2 = OmodA (80) 
^ (a'"/2-l)(a'^/2 + l) = OmodA. (81) 

The product (0*^/2 „ i)(a'-/2 4. 1) ^lust be some multiple of N, so unless 
— j-i niod N at least one of terms must have a nontrivial factor in common 
with N. By computing the greatest common divisor of this term and N, one 
gets a non-trivial factor of N. 
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Furthermore, if N is odd with prime factorisation 



A^^pr^r (82) 

then it can be shown that if a < iV is chosen at random such that gcd(a, N) = 
1 then the probabihty that its order modulo N is even and that a^^^ 7^ ±1 mod 
N is: 

Pr(r is even AND a''/^ ^ ±1 mod iV) > 1 - (83) 

Thus, combining our estimates of success at each step, with probabihty greater 
than or equal to 



7r2 Inr V 2«-i J ' InN 

we find a factor of N ^. (Here we have used that N is composite and r < N.) If 
N is logiV = n bits long then by repeating the whole process 0{n) times, or by 
a running 0{n) computations in parallel by a suitable extension of a quantum 
factoring network, we can then guarantee that we will find a factor of N with a 
fixed probability greater than i. This, and the fact that the quantum network 
family for controlled multiplication modulo some number is uniform and of size 
0(n2), tells us that factoring is in the complexity class BQP. 
But why should anybody care about efficient factorisation? 



9 Cryptography 

Human desire to communicate secretly is at least as old as writing itself and 
goes back to the beginnings of our civilisation. Methods of secret communica- 
tion were developed by many ancient societies, including those of Mesopotamia, 
Egypt, India, and China, but details regarding the origins of cryptologj^ remain 
unknown | |2^ . 

Originally the security of a cryptosystem or a cipher depended on the se- 
crecy of the entire encrypting and decrypting procedures; however, today we 
use ciphers for which the algorithm for encrypting and decrypting could be re- 
vealed to anybody without compromising their security. In such ciphers a set 
of specific parameters, called a key, is supplied together with the plaintext as 
an input to the encrypting algorithm, and together with the cryptogram as an 
input to the decrypting algorithm |2^ . This can be written as 

Ef,{P) = C, and conversely, t)k{C) = P, (85) 

where P stands for plaintext, C for cryptotext or cryptogram, k for crypto- 
graphic key, and E and D denote an encryption and a decryption operation 
respectively. 

'^N.B. by Eq.(|83[), the method fails if is a prime power, N = p°', but prime powers can 
be efficiently recognised and factored by classical means. 

^The science of secure communication is called cryptology from Greek kryptos hidden and 
logos word. Cryptology embodies cryptography, the art of code-making, and cryptanalysis, 
the art of code-breaking. 
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The encrypting and decrypting algorithms are pubhcly known; the security 
of the cryptosystem depends entirely on the secrecy of the key, and this key 
must consist of a randomly chosen, sufficiently long string of bits. Probably the 
best way to explain this procedure is to have a quick look at the Vernam cipher, 
also known as the one-time pad p9[ . 

If we choose a very simple digital alphabet in which we use only capital 
letters and some punctuation marks such as 



A 


B 


C 


D 


E ... 


... X 


Y 


Z ? , . 


00 


01 


02 


03 


04 ... 


... 23 


24 


25 26 27 28 29 



we can illustrate the secret-key encrypting procedure by the following simple 
example (we refer to the dietary requirements of 007): 

SHAKEN NOT STIRRED 

18 07 00 10 04 13 26 13 14 19 26 18 19 08 17 17 04 03 

15 04 28 13 14 06 21 11 23 18 09 11 14 01 19 05 22 07 

03 11 28 23 18 19 17 24 07 07 05 29 03 09 06 22 26 10 

In order to obtain the cryptogram (sequence of digits in the bottom row) 
we add the plaintext numbers (the top row of digits) to the key numbers (the 
middle row), which are randomly selected from between and 29, and take the 
remainder after division of the sum by 30, that is we perform addition modulo 
30. For example, the first letter of the message "S" becomes a number "18" in 
the plaintext, then we add 18 -I- 15 = 33; 33 = 1 x 30 -I- 3, therefore we get 03 
in the cryptogram. The encryption and decryption can be written as Pi + ki 
(mod 30) = Ci and Ci — ki (mod 30) = Pi respectively for the symbol at 
position i. 

The cipher was invented in 1917 by the American AT&T engineer Gilbert 
Vernam. It was later shown, by Claude Shannon that as long as the key 
is truly random, has the same length as the message, and is never reused then 
the one-time pad is perfectly secure. So, if we have a truly unbreakable system, 
what is wrong with classical cryptography? 

There is a snag. It is called key distribution. Once the key is established, 
subsequent communication involves sending cryptograms over a channel, even 
one which is vulnerable to total passive eavesdropping {e.g. public announce- 
ment in mass-media). This stage is indeed secure. However in order to establish 
the key, two users, who share no secret information initially, must at a certain 
stage of communication use a reliable and a very secure channel. Since the inter- 
ception is a set of measurements performed by an eavesdropper on this channel, 
however difficult this might be from a technological point of view, in principle 
any classical key distribution can always be passively monitored, without the 
legitimate users being aware that any eavesdropping has taken place. 

In the late 1970s Whitfield DifHe and Martin Hellman proposed an 
interesting solution to the key distribution problem. It involved two keys, one 
public key tt for encryption and one private key k for decryption: 

E^iP) = C, and D,{C) = P. (86) 
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In these systems users do not need to share any private key before they start 
sending messages to each other. Every user has his own two keys; the pubhc 
key is pubhcly announced and the private key is kept secret. Several pubhc-key 
cryptosystems have been proposed since 1976; here we concentrate our attention 
on the most popular one namely the RSA . In fact the techniques were first 
discovered at CESG in the early 1970s by James Ellis, who called them "Non- 
Secret Encryption " [p3| . In 1973, building on Ellis' idea, C. Cocks designed what 
we now call RSA |34(|, and in 1974 M. Williamson proposed what is essentially 
known today as the Difhe-HcUman key exchange protocol. 

Suppose that Alice wants to send an RSA encrypted message to Bob. The 
RSA encryption scheme works as follows: 

Key generation Bob picks randomly two distinct and large prime numbers p 
and q. We denote n — pq and (f> = {p— l){q— 1). Bob then picks a random 
integer 1 < e < ((> that is coprime with (/>, and computes the inverse d of e 
modulo (f) (gcd(e, 0) = 1). This inversion can be achieved efficiently using 
for instance the extended Euclidean algorithm for the greatest common 
divisor Bob's private key is k = d and his public key is tt = (e, n) 

Encryption Alice obtains Bob's public key tt — (e, n) from some sort of yellow 
pages or an RSA public key directory. Alice then writes her message as a 
sequence of numbers using, for example, our digital alphabet. This string 
of numbers is subsequently divided into blocks such that each block when 
viewed as a number P satisfies P < n. Alice encrypts each P as 

C = E^{P) = P" mod n (87) 
and sends the resulting cryptogram to Bob. 
Decryption Receiving the cryptogram C, Bob decrypts it by calculating 

Z)^(C) = C"^ mod 71 = P (88) 

where the last equality will be proved shortly. 

The mathematics behind the RSA is a lovely piece of number theory which 
goes back to the XVI century when a French lawyer Pierre de Fermat discovered 
that if a prime p and a positive integer a are coprime, then 

a^'-^^lmodp. (89) 

The cryptogram C = P'^ mod n is decrypted by mod n = P'^'^ mod n 
because ed — 1 mod cf), implying the existence of an integer k such that ed = 
kcj) + I — k{p — l)(q — 1) + 1. IfP^^O mod p, using equation (9.5) this implies 

P"'^ mod p = (p(p-^)Y'^'^ P mod p = P mod p. (90) 
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The above equality holds trivially in the case P = mod p. By identical 
arguments, P^'^ mod q = P mod q. Since p and q are distinct primes, it follows 
that 

P"'^ mod n = P. (91) 

For example, let us suppose that Bob's public key is vr = (e, n) = (179, 571247). ^ 
He generated it following the prescription above choosing p = 773, q = 739 and 
e = 179. The private key d was obtained by solving 179c? = 1 mod 772 x 738 
using the extended Euclidean algorithm which yields d = 515627. Now if we 
want to send Bob encrypted "SHAKEN NOT STIRRED" we first use our digital 
alphabet to obtain the plaintext which can be written as the following sequence 
of six digit numbers 

180700 100413 261314 192618 190817 170403 

Then we encipher each block Pi by computing Ci — mod n; e.g. the first 
block Pi ~ 180700 will be eciphered as 

mod n = 180700"^ mod 571247 = 141072 = Ci, (92) 

and the whole message is enciphered as: 

141072 253510 459477 266170 286377 087175 

The cryptogram C composed of blocks Ci can be send over to Bob. He can 
then decrypt each block using his private key d = 515627, e.g. the first block is 
decrypted as 

^4^Q725i5627 jj^Q J 571247 = 180700 = Pi . (93) 

In order to recover plaintext P from cryptogram C, an outsider, who knows 
C, n, and e, would have to solve the congruence 

P" mod n = C, (94) 

for example, in our case, 

Pi^^^ mod 571247 = 141072. (95) 

Solving such an equation is believed to be a hard computational task for clas- 
sical computers. So far, no classical algorithm has been found that computes 
the solution efficiently when n is a large integer (say 200 decimal digits long or 
more). However, if we know the prime decomposition of n it is a piece of cake 
to figure out the private key d: we simply follow the key generation procedure 
and solve the congruence ed — 1 mod {p—l){q—l). This can be done efficiently 
even when p and q are very large. Thus, in principle, anybody who knows n 
can find d by factoring n. The security of RSA therefore relies among others 
on the assumption that factoring large numbers is computationally difficult. 

Needless to say, number n in this example is too small to guarantee security, do not try 
this public key with Bob. 
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In the context of classical computation, such difficulty has never been proved. 
Worse still, we have seen in Section 8 that there is a quantum algorithm that 
factors large number efficiently. This means that the security of the RSA cryp- 
tosystem will be completely compromised if large-scale quantum computation 
becomes one day practical. This way, the advent of quantum computation rules 
out public cryptographic schemes commonly used today that are based on the 
"difficulty" of factoring or the "difficulty" of another mathematical operation 
called discrete logarithm Q. 

On the other hand, quantum computation provides novel techniques to gen- 
erate a shared private key with perfect confidentiality, regardless the compu- 
tational power (classical or quantum) of the adversaries. Such techniques are 
referred to as quantum key distribution protocols and were proposed indepen- 
dently in the United States (S.Wiesner C.H. Bennett and G. Brassard |^ ) 
and in Europe (A. Ekert ||37|| ). Discussion on quantum key distribution is outside 
the scope of this lecture. 

10 Conditional quantum dynamics 

Quantum gates and quantum networks provide a very convenient language for 
building any quantum computer or (which is basically the same) quantum mul- 
tiparticle interferometer. But can we build quantum logic gates? 

Single qubit quantum gates are regarded as relatively easy to implement. For 
example, a typical quantum optical realisation uses atoms as qubits and controls 
their states with laser light pulses of carefully selected frequency, intensity and 
duration; any prescribed superposition of two selected atomic states can be 
prepared this way. 

Two-qubit gates are much more difficult to build. 

In order to implement two-qubit quantum logic gates it is sufficient, from the 
experimental point of view, to induce a conditional dynamics of physical bits, 
i. e. to perform a unitary transformation on one physical subsystem conditioned 
upon the quantum state of another subsystem, 

U =\{)){{)\®Uo + \l){l\(i)Ui + --- + \k){k\®Uk, (96) 

where the projectors refer to quantum states of the control subsystem and the 
unitary operations Ui are performed on the target subsystem The sim- 
plest non-trivial operation of this sort is probably a conditional phase shift such 
as B{(j)) which we used to implement the quantum Fourier transform and the 
quantum controUed-NOT (or xor) gate. 

Let us illustrate the notion of the conditional quantum dynamics with a 
simple example. Consider two qubits, e.g. two spins, atoms, single-electron 
quantum dots, which are coupled via a ai^Vi^'' interaction {e.g. a dipole-dipole 
interaction) : 
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The first qubit, with resonant frequency Wi, will act as the control qubit and 
the second one, with resonant frequency U!2, as the target qubit. Due to the 
coupling V the resonant frequency for transitions between the states | 0) and 1 1) 
of one qubit depends on the neighbour's state. The resonant frequency for the 
first qubit becomes wi ± fl depending on whether the second qubit is in state 
I 0) or 1 1). Similarly the second qubit's resonant frequency becomes UJ2 ± f^, 
depending on the state of the first qubit. Thus a 7r-pulse at frequency uj2 + ^ 
causes the transition | 0) 1 1) in the second qubit only if the first qubit is in 
1 1) state. This way we can implement the quantum controlled-NOT gate. 



11 Decoherence and recoherence 

Thus in principle we know how to build a quantum computer; we can start with 
simple quantum logic gates and try to integrate them together into quantum 
networks. However, if we keep on putting quantum gates together into networks 
we will quickly run into some serious practical problems. The more interacting 
qubits are involved the harder it tends to be to engineer the interaction that 
would display the quantum interference. Apart from the technical difficulties 
of working at single-atom and single-photon scales, one of the most important 
problems is that of preventing the surrounding environment from learning about 
which computational path was taken in the multi-particle interferometer. This 
"welcher Weg" information can destroy the interference and the power of quan- 
tum computing. 



Consider the following qubit-cnvironment interaction, known as decoherence\38\, 

|0,m) |0,mo), |l,m) |l,mi), (97) 

where |m) is the initial state and \mo), \mi) are the two final states of the envi- 
ronment. This is basically a measurement performed by the environment on a 
qubit. Suppose that in our single qubit interference experiment (see Eqs. (^3|)) 
a qubit in between the two Hadamard transformation is "watched" by the en- 
vironment which learns whether the qubit is in state |0) or The evolution 
of the qubit and the environment after the first Hadamard and the phase gate 
is described by the following transformation, 

I 0) I m) ^ i= (I 0) + 1 1)) I m) ^ -L(e»*/2 | 0) + e^^/^ 1 1)) | m) . (98) 
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We write the decoherence action as 

-^(e4 I 0) + e-t \l))\m)^ \ 0) | mo) + e^^ 1 1) | mi)). (99) 

The final Hadamard gate generates the output state 

i=(e^l|0)|mo)+e-^ |l)|mi)) (100) 



H 1 



-|0) (e^^ I mo) + e-^^ I mi)) 



+ i|l)(e'^ |mo)-e-^^ |mi)). (101) 

Taking | mo) and | mi) to be normalised and (mo | mi) to be real we obtain 
the probabilities Pq and Pi, 

Po = i(l + (mo|mi)cos0), (102) 

Pi - i(l- (molmi)cos,/)). (103) 

It is instructive to see the effect of decoherence on the qubit alone when its 
state is written in terms as a density operator. The decoherence interaction 
entangles qubits with the environment, 

(a|0) +/3|l))|m) K^a|0)|mo)+/3|l)|mi). (104) 

Rewriting in terms of density operators and tracing over the environment's 
Hilbert space on the both sides, we obtain 



|a|^ a(i* \ ( \af' a/3*(mo|mi) 



) \ a*/3(mi|mo) 1/31' 



(105) 



The off-diagonal elements, originally called by atomic physicists coherences, van- 
ish as (mil mo) i— > 0, that is why this particular interaction with the environment 
is called decoherence. 

How does decoherence affect, for example, Deutsch's algorithm? Substitut- 
ing or TT for in Eq.( |l02| ) we see that we obtain the correct answer only with 
some probability, which is 

^^^^^\^-) , (106) 

If (mo I mi) = 0, the perfect decoherence case, then the network outputs or 1 
with equal probabilities, i.e. it is useless as a computing device. It is clear that 
we want to avoid decoherence, or at least diminish its impact on our computing 
device. 

In general when we analyse physically realisable computations we have to 
consider errors which are due to the computer-environment coupling and from 
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the computational complexity point of view we need to assess how these er- 
rors scale with the input size n. If the probability of an error in a single run, 
S{n), grows exponentially with n, i.e. if 6{n) = 1 — ylexp(— an), where A and 
a are positive constants, then the randomised algorithm cannot technically be 
regarded as efficient any more regardless of how weak the coupling to the en- 
vironment may be. Unfortunately, the computer-environment interaction leads 
to just such an unwelcome exponential increase of the error rate with the in- 
put size. To see this consider a register of size n and assume that each qubit 
decoheres separately, 

I x) I M) = I Xn-i ■ . • xixo) \ m) ...\m)\m) 

\xn-i---XiXo)\mx^_^) ...\m^^)\mxg) ^\x)\Mx) , (107) 

where Xi £ {0, 1}. Then a superposition a\x) + P\y) evolves as 

{a\x)+p\y))\M)^a\x)\ M,) +p\y)\ My) , (108) 

but now the scalar product {M^ \ My) which reduces the off-diagonal elements 
of the density operator of the whole register and which affects the probabilities 
in the interference experiment is given by 

{M^ I My) = {m^g I niyg) {m^^ \ niy^)... (m:r„_i | my^^i) (109) 

which is of the order of 

{M,\My) = {m^\m^)"^-^y\ (110) 

where H{x,y) is the Hamming distance between x and y, i.e. the number of 
binary places in which x and y differ {e.g. the Hamming distance between 
101101 and 111101 is 1 because the two binary string differ only in the second 
binary place). Hence there are some coherences which disappear as (mo | mi)" 
and therefore in some interference experiments the probability of error may grow 
exponentially with n. 

It is clear that for quantum computation of any reasonable length to ever be 
physically feasible it will be necessary to incorporate some efficiently realisable 
stabilisation scheme to combat the effects of decoherence. Deutsch was the first 
one to discuss this problem. During the Rank Prize Funds Mini-Symposium 
on Quantum Communication and Cryptography, Broadway, England in 1993 
he proposed 'recoherence' based on a symmetrisation procedure (for details 
see [|9j). The basic idea is as follows. Suppose we have a quantum system, 
we prepare it in some initial state | 4*^) and we want to implement a prescribed 
unitary evolution | ^(t)) or just preserve | ^'i) for some period of time t. Now, 
suppose that instead of a single system we can prepare R copies of | ^P^) and 
subsequently we can project the state of the combined system into the symmet- 
ric subspace i.e. the subspace containing all states which are invariant under 
any permutation of the sub-systems. The claim is that frequent projections 
into the symmetric subspace will reduce errors induced by the environment. 
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The intuition behind this concept is based on the observation that a prescribed 
error-free storage or evolution of the R independent copies starts in the sym- 
metric sub-space and should remain in that sub-space. Therefore, since the 
error-free component of any state always lies in the symmetric subspace, upon 
successful projection it will be unchanged and part of the error will have been 
removed. Note however that the projected state is generally not error-free since 
the symmetric subspace contains states which are not of the simple product 
form I 5') I vlf) . . . I xp) . Nevertheless it has been shown that the error probability 
will be suppressed by a factor of 1 /R Q . 

More recently projections on symmetric subspaces were replaced by more 
complicated projections on carefully selected subspaces. These projections, pro- 
posed by Shor @, Calderbank and Shor |l[, Steane [|| and others ||, ||, ||, 



47 , are constructed on the basis of classical error-correcting methods but 
represent intrinsically new quantum error-correction and stabilisation schemes; 
they are the subject of much current study. 

Let us illustrate the main idea of recoherence by describing a simple method 
for protecting an unknown state of a single qubit in a noisy quantum register. 
Consider the following scenario: we want to store in a computer memory one 
qubit in an unknown quantum state of the form | (/>) = a | 0) -I-/3 | 1) and we know 
that any single qubit which is stored in a register undergoes a decoherence type 



entanglement with an environment described by Eq.(104). To see how the state 
of the qubit is affected by the environment, we calculate the fidelity of the 
decohered state at time t with respect to the initial state | (j>) 

= (HI) 

where p{t) is given by Eq. ( |l05| ). It follows that 

F{t) - \af + \pf + 2\a\'m^Re[{mo{t) \ m,{t))] . (112) 

The expression above depends on the initial state | 0) and clearly indicates 
that some states are more vulnerable to decoherence than others. In order to 
get rid of this dependence we consider the average fidelity, calculated under the 
assumption that any initial state | 4>) is equally probable. Taking into account 
the normalisation constraint the average fidelity is given by 

F{t) - F{t) d lap = i(2 + Rc[(mo(t) | m,m) ■ (US) 

If we assume an exponential-type decoherence, where (mo(i) | TOi(t)) — e~'^*, 
the average fidelity takes the simple form 

F(t) = i(2 + e-'*). (114) 

In particular, for times much shorter than the decoherence time td = I/7, the 
above fidelity can be approximated as 

F{t)^l-^jt + Oi^V) . (115) 
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Let us now show how to improve the average fidchty by quantum encoding. 
Before we place the qubit in the memory register we encode it: we can add two 
qubits, initially both in state |0), to the original qubit and then perform an 
encoding unitary transformation 

1000) ^ |000) = (|0) + |1))(|0) + |1))(|0) + |1)), (116) 
1 100) ^ |111) = (|0)-|1))(|0)-|1))(|0)-|1)), (117) 

generating state a \ 000) + /3 1 111), where | 0) = | 0) + 1 1) and 1 1) = | 0) - 1 1). 

Now, suppose that only the second stored qubit was affected by decoherence 
and became entangled with the environment: 



a(|0) + |l))(|0)|mo) 
/3(|0)-|l))(|0)|mo) 



l)|™i))(|0) + |l))- 
l)|mi))(|0)-|l)). 



(118) 



which can also be written as 

(a I 000) + /3 1 111))(| mo) + | mi)) + (a | 010) + /3 1 101))(| mo) - | mi)). (119) 

The decoding unitary transformation can be constructed using a couple of 
quantum controUed-NOT gates and the Toffoli gate, thus completing the error- 
correcting network: 



a|0)+/3|l) 



|0) ^ 
|0) — 



H 



H 



H 



Encoded State 

a I 000) + /3 I lii) 



H 



H 



H 



a\0)+(3\l) 
\ 



I ^2) 



ENCODING DECOHERENCE AREA DECODING 



Careful inspection of the network shows that any single phase-flip | 0) 1 1) 
will be corrected and the environment will be effectively disentangled from the 
qubits. In our particular case we obtain 

(a I 0) + /3 1 1)) [| 00) (I mo) + | mi)) + 1 10) (| mo) - | mi))]. (120) 

The two auxiliary outputs carry information about the error syndrome - 00 
means no error, 01 means the phase-flip occurred in the third qubit, 10 means 
the phase-flip in the second qubit and 11 signals the phase flip in the flrst qubit. 

Thus if only one qubit in the encoded triplet decoheres we can recover the 
original state perfectly. In reality all three qubits decohere simultaneously and, 
as the result, only partial recovery of the original state is possible. In this 
case lengthy but straightforward calculations show that the average fidelity of 
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the reconstructed state after the decoding operation for an exponential-type 
decoherence is 

Fec(i) = i[4 + 3e-^*-e-37*] . (121) 
For short times this can be written as 

Fec(t)-l-^7'i' + 0(7't')- (122) 



Comparing Eq. (114) with Eq. (121), we can easily see that for all times t, 

Fecit) > F{t). (123) 

This is the essence of recoherence via encoding and decoding. There is much 
more to say (and write) about quantum codes and the reader should be warned 
that we have barely scratched the surface of the current activities in quantum 
error correction, neglecting topics such as group theoretical ways of constructing 
good quantum codes concatenated codes quantum fault tolerant 

computation Esl and many others. 



12 Concluding remarks 

Research in quantum computation and in its all possible variations has become 
vigorously active and any comprehensive review of the field must be obsolete 
as soon as it is written. Here we have decided to provide only some very basic 
knowledge, hoping that this will serve as a good starting point to enter the field. 
Many interesting papers in these and many related areas can be found at the Los 



Alamos National Laboratory e-print archive ( http: / /xxx. lanl.gov / archive / quant 



ph) and on the web site of the Center for Quantum Computation (www.qubit.org). 
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